CVE-2026-85644: XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference

XS::Parse::Infix 0.40 through 0.49 builds Perl wrappers for list-associative infix operators that are supposed to accept array references, but the guard uses SvRV() without first checking that the value is a reference. A number or other non-reference can therefore be treated as an array, and the interpreter dereferences memory that was never a valid referent, which typically crashes the process with a segmentation fault. If an application feeds the wrapper a list built from decoded external input, such as JSON, the supplier of that input can influence what address is dereferenced; a crafted string can be accepted as an array and its contents pushed onto the Perl stack as live values. Perl programs that load this module and pass untrusted lists into those operators, including users of Syntax::Operator::Zip, are affected. Exploitation in the wild is not known, no separate public proof of concept is recorded, and the issue is not listed in CISA KEV.